The current information and technology (IT) system (hereinafter, referred to simply as the system) includes a large number of devices such as servers, storage devices, and network devices. Furthermore, an observing device that observes the operating status of the system is also included in the system. The observing device obtains a huge amount of time-series data from the large number of devices included in the system in order to determine whether the system is normally operating. For example, the observing device obtains information relating to the statuses of use of a central processing unit (CPU) and a memory of each server and displays time change of the statuses of use on a monitor by a graph. However, when the amount of displayed items becomes very large, it becomes difficult for an operation administrator to visually check the items and recognize the occurrence of an abnormal state.
Therefore, there has been devised a method for efficiently determining the kind, occurrence place, and cause of an abnormality or assisting the determination in a complex system (for example, International Publication Pamphlet No. WO 2012/090718). Furthermore, there has also been devised a method for alleviating the work load in setting a condition for determining whether the current state is the state in which a predictor of a service level breach in a system appears (for example, International Publication Pamphlet No. WO 2012/067031). Moreover, there has also been devised a method for detecting an anomaly in multivariate time-series data acquired by a sensor of equipment for monitoring the equipment state (for example, Japanese Laid-open Patent Publication No. 2013-246818).